Comment by nonrandomstring | Hacker News Reader

Comment by nonrandomstring | Hacker News Reader

Parent Full thread

nonrandomstring

> Your sysadmin, especially of the bigger orgs, do not want encryption on your emails.

This is the nub of it. People don't know what they want from technology. Or rather, they are conflicted. Our collective illusion that rational technical concerns drive technology hides the reality that all digital technology is a set of power relations that help or hinder different spheres of interest - often within the same group or individuals. Many people want to do bad things and we have even created laws that insist people do bad things (as piss poor solutionism to the original bad things). Hole, spade, keep digging.

The problem of email can be seen two ways:

1. Bad protocols.

2. Bad actors.

Naturally, as techies we attack (1). Just encrypt it all. Zero trust. Train everybody to use encryption. Enforce it. Let's call that the "Rule of Tech".

By contrast, let's call (2) the "Rule of Law". There are already more than enough laws that deal with the fundamental immorality of reading someone else's private correspondence. However we have carved out so many exceptions, including those in the interests of our own profits, that we now just assume (2) is an intractable feature of the world. It isn't.

Email has shown us time and time again that the solutionism of getting people to use encryption is nigh-on impossible. Even the US government have pretty much said PGP is a dead approach.

So let's ask the question nobody wants to hear; Would it be economically wiser to enter into more layers of solutions, securing email at the technical and policy level (1), or to take a GDPR-like approach of bolstering the rule of law?

Let's be clear - this would mean taking NSA, GCHQ, Google, Microsoft etc to court, fining and if necessary dismantling the assets of those who interfere with private communication. It would mean stripping ISPs of listening taps, and auditing server rooms. It would mean something approcimating to a civic cyber police force acting IN THE INTERESTS of the public, rather than against us.

I realise how naive that sounds in this cynical epoch. But I think the ultimate cost of 'zero-trust' society may greatly outweigh the political cost of using the Rule of Law to re-establish 'trusted' networks.

Can't we give the law a chance?

> Can't we give the law a chance?

No because law makers have at every turn attempted to undermine encryption. What makes you think they'll suddenly fine and/or dismantle the assets of the NSA/GCHQ? These are the agencies that have been central to both countries' security in times of war. Times of war that seemingly has never ended.

I think one should not confuse support for the Rule of Law with exasperation at the parochial "lawmakers" who are poorly educated, motivated by power and money, and thus essentially traitors to the principle. That would be cynicism.

>Even the US government have pretty much said PGP is a dead approach.

I would be very interested in a reference to that...

So would I , but I can't find it so you'll have to do your own digging. It was posted here on HN about 3 weeks ago. It was a report by a major TLA announcing a significant revision of cybersecurity "best practices", one of which was to stop pushing email encryption as it's deemed more trouble than it's worth.

Found it at last.

It's back on the front page of HN

https://news.ycombinator.com/item?id=30530592

It's the Whitehouse.

You're starting down a very interesting/sanguine line of questioning, but you're leaving out another complication of "bad actors". The number of sysadmins and netops out there is very large. While some certainly are malicious or are motivated by privacy-violating desires (whether organizational or personal), many of them are just overworked, underpaid, or underqualified. When it comes to email, a single unencrypted link is all it takes to break the trusted chain of Email. Given the sheer multiplicity of the problem, IMO a GDPR-like approach would meet too much pushback from organizations who already don't want to hire a sysadmin.

In this case the reason why I think it's worth focusing on the protocol is that, when an E2E encrypted protocol is designed properly, it removes an entire attack surface and significantly decreases the amount of possible human error. I think encrypted L7 overlay networks are a good solution to step aside these problems at the cost of a bit of overhead (wrapping packets, etc)

> many of them are just overworked, underpaid, or underqualified.

Absolutely. I didn't mean to seem uncharitable to the average sysop. We've all been there. In fact this state of affairs means that clear legal frameworks, simple messaging that everyone understands, could be powerful. Bad actors mainly exist at a higher level. Over-stretched people in moral grey areas benefit from clear reasons to act decisively, which is why we make sure soldiers get unambiguous orders.

If all sysadmins and developers knew they could go to jail for reading or enabling another to read private communications sent with a reasonable expectation of confidentiality, we'd be in a very different place.

Unfortunately we've let this slip, and entered a cultural interregnum in which we kinda expect emails to be read by others, and even assume they will be. That's not okay. Because even if we fix-up the protocol level there's a residual expectation that it's alright to work around it "because we need to read peoples' emails", right?

> I think encrypted L7 overlay networks are a good solution to step > aside these problems at the cost of a bit of overhead (wrapping > packets, etc)

Yes, I absolutely agree with you. If email can be fixed it has to happen at a whole new "Tor for email" level. Hell, maybe we could all start running our servers as open relays again, given that we'll not know exactly what we are routing.

But I think the law has a part to play. If only to kick-start the initiative to secure email, because right now the surveillance capitalists and spooks are entrenched in a criminal mind-set. Caveat Dolev-Yeo notwithstanding, one can't build trustworthy systems on that culture however good the tech.

> Absolutely. I didn't mean to seem uncharitable to the average sysop. We've all been there.

Hehe I've met some pretty self-important sysops so let's not be too charitable here ;) (just a joke!)

> Unfortunately we've let this slip, and entered a cultural interregnum in which we kinda expect emails to be read by others, and even assume they will be. That's not okay. Because even if we fix-up the protocol level there's a residual expectation that it's alright to work around it "because we need to read peoples' emails", right?

Is this specifically an email thing? There's a weird culture I've encountered in older organizations that place a lot of emphasis on networks owned by an organization. The organizations themselves seem to have almost a fetish for controlling data that goes across their networks and likewise their net/sysops partake in this culture of absolute control. Maybe it's the same people who are incensed today that social media can act like a safe harbor. Maybe it comes from a time where the cost of sending/receiving a packet was legitimately quite expensive. I'm not sure. I'm glad that most modern attitudes on network management have given up the idea that owning a network means total control of every packet that enters and exits it.

> Yes, I absolutely agree with you. If email can be fixed it has to happen at a whole new "Tor for email" level. Hell, maybe we could all start running our servers as open relays again, given that we'll not know exactly what we are routing.

There are a whole bunch of projects in this space. Everything from overlay networks (Yggdrassil, Zerotier, Tailscale) to mixnets (like Nym) to remailers (like Bitmessage.) We just need to spread the word.

> If all sysadmins and developers knew they could go to jail for reading or enabling another to read private communications sent with a reasonable expectation of confidentiality, we'd be in a very different place.

> But I think the law has a part to play. If only to kick-start the initiative to secure email, because right now the surveillance capitalists and spooks are entrenched in a criminal mind-set. Caveat Dolev-Yeo notwithstanding, one can't build trustworthy systems on that culture however good the tech.

I'm a big fan of this idea FWIW. I just think, realistically, adoption will be slow as small ISPs and organizations throw temper tantrums about how they're being steamrolled by Big Tech and use than as an excuse to both read/intercept traffic and to offer subpar QoS to their customers. There's only so much to be gained by suing a tiny ISP in Florida that is sending mail in the clear because they downsized their netops staff years ago and now they still serve 5 elderly customers who don't want to switch through the occasional contractor.

I'm trying to put aside more time to get into Yggdrassil

It has a desirable side-effect of getting me into IPv6 with a positive attitude after successfully putting it off for 20 years. Cheers.

Reply on news.ycombinator.com